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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address- 

All claims being allowable, PROSECUTION ON THE MERITS IS (OR REMAINS) CLOSED in this application. If not included 
herewith (or previously mailed), a Notice of Allowance (PTOL-85) or other appropriate communication will be mailed in due course. THIS 
NOTICE OF ALLOWABILITY IS NOT A GRANT OF PATENT RIGHTS. This application is subject to withdrawal from issue at the initiative 
of the Office or upon petition by the applicant. See 37 CFR 1.313 and MPEP 1308. 

1 . |EI This communication is responsive to 18 December 2007 and 25 February 2008. 

2. The allowed claim(s) is/are 1-7, 16-22, 31-37 and 46-52 . 

3. □ Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 

a) □ All b)DSome* c) □ None of the: 

1. □ Certified copies of the priority documents have been received. 

2. □ Certified copies of the priority documents have been received in Application No. . 

3. □ Copies of the certified copies of the priority documents have been received in this national stage application from the 

International Bureau (PCT Rule 17.2(a)). 
* Certified copies not received: . 

Applicant has THREE MONTHS FROM THE "MAILING DATE" of this communication to file a reply complying with the requirements 
noted below. Failure to timely comply will result in ABANDONMENT of this application. 
THIS THREE-MONTH PERIOD IS NOT EXTENDABLE. 

4. □ A SUBSTITUTE OATH OR DECLARATION must be submitted. Note the attached EXAMINER'S AMENDMENT or NOTICE OF 

INFORMAL PATENT APPLICATION (PTO-152) which gives reason(s) why the oath or declaration is deficient. 

5. □ CORRECTED DRAWINGS ( as "replacement sheets") must be submitted. 

(a) □ including changes required by the Notice of Draftsperson's Patent Drawing Review ( PTO-948) attached 

1 ) □ hereto or 2) □ to Paper No./Mail Date . 

(b) □ including changes required by the attached Examiner's Amendment / Comment or in the Office action of 

Paper No./Mail Date . 

Identifying indicia such as the application number (see 37 CFR 1. 84(c)) should be written on the drawings in the front (not the back) of 
each sheet. Replacement sheet(s) should be labeled as such in the header according to 37 CFR 1.121(d). 

6. □ DEPOSIT OF and/or INFORMATION about the deposit of BIOLOGICAL MATERIAL must be submitted. Note the 

attached Examiner's comment regarding REQUIREMENT FOR THE DEPOSIT OF BIOLOGICAL MATERIAL. 
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Paper No./Mail Date 

4. □ Examiner's Comment Regarding Requirement for Deposit 

of Biological Material 



5. □ Notice of Informal Patent Application 

6. □ Interview Summary (PTO-413), 

Paper No./Mail Date . 

7. ^ Examiner's Amendment/Comment 

8. ^ Examiner's Statement of Reasons for Allowance 

9. □ Other . 
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DETAILED ACTION 

1 . The Applicant's amendments, filed 18 December, 2007 and 25 February 2008, have been received 
and entered into the record, and respectfully and carefully considered. 

2. As a result of the amendment, claims 1 , 4-5, 1 6, 1 9-20, 31 , 34-35, 46 and 49-50 have been 
amended; claims 8-15, 23-30, 38-45 and 53 -63 are withdrawn. Therefore, claims 1 -63 are pending in this 
application. 

Specification 

3. As a result of the amendment to the specification and Applicant's argument is persuasive; therefore, 
the examiner withdraws the pending objection. 

Double Patenting 

4. Applicant's arguments to double patenting rejection are entered and the arguments are persuasive 
and therefore, the examiner withdraws the double-patenting rejection (Please see also see advisory action 
issued by the examiner on 22 January 2008, in which the examiner states the double patenting rejection is 
withdrawn). 

EXAMINER'S AMENDMENT 

5. An examiner's amendment to the record appears below. Should the changes and/or additions be 
unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1 .312. To ensure 
consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee. 
Authorization for this examiner's amendment was given in a telephone interview with Mr. Forrest Gunnison 
(Registration No. 32,899) on 8 April 2008. The amendments are to cancel non-elected claims and further 
clarify the invention. 
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The application has been amended as follows: 
IN THE CLAIMS: 

> Claims 8-15, 23-30, 38-45 and 53-63 (Cancelled) 

> Amended claims: 

(Claim 1). (Currently Amended) A method for executing an obfuscated application program, the method 
comprising: 

receiving an obfuscated application program, said obfuscated application program comprising at 
least one instruction opcode value encoded using one of a plurality of instruction set opcode value 
encoding schemes, 

wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to said at least one instruction opcode value A 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction sek -and so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; 
determining a dispatch table associated with said application program, said dispatch table 
corresponding to said one of a plurality of instruction set opcode value encoding schemes; and 
executing said application program using said associated dispatch table. 
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(Claim 3). (Currently Amended) The method of claim 1 wherein said determining comprises selecting a 
dispatch table from asaid plurality of dispatch tables in response to said receiving, said plurality of dispatch 
tables stored in a memory. 

(Claim 4). (Currently Amended) A method for executing an obfuscated application program, the method 
comprising: 

receiving an obfuscated application program, said obfuscated application program comprising at 
least one instruction opcode value encoded using one of a plurality of non-standard instruction set 
opcode value encoding schemes, 

wherein each of said non-standard instruction set opcode value encoding schemes include 
an entry corresponding to said at least one instruction opcode value^ 

each of said non-standard instruction opcode value encoding schemes is represented 
in a different dispatch table in a plurality of dispatch tables: 
each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction set ^and so that each of said non-standard instruction set 
opcode value encoding schemes uses a different opcode value encoding for said 
entry; 
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determining an instruction set opcode value encoding scheme associated with said obfuscated 
application program; 

rewriting said application program using a standard opcode value encoding scheme if said received 
application program is not encoded using said standard opcode value encoding scheme; and 
executing said application program using a dispatch table associated with said standard opcode 
value encoding scheme. 



(Claim 5). (Currently Amended) A method for application program obfuscation, the method comprising: 
reading an application program comprising code; 

transforming said application program code into transformed application program code that uses 
one of a plurality of opcode value encoding schemes of a dispatch table associated with said 
application program, 

wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to at least one instruction opcode value^ 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set; and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction set f-and so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; and 
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sending said transformed application program code. 

(Claim 16). (Currently Amended) A program storage device readable by a machine, embodying a 
program of instructions executable by the machine to perform a method for executing an obfuscated 
application program, the method comprising: 

receiving an obfuscated application program, said obfuscated application program comprising at 
least one instruction opcode value encoded using one of a plurality of instruction set opcode value 
encoding schemes, 

wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to said at least one instruction opcode value,. 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction set f-and so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; 
determining a dispatch table associated with said application program, said dispatch table 
corresponding to said one of a plurality of instruction set opcode value encoding schemes; and 
executing said application program using said associated dispatch table. 
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(Claim 18). (Currently Amended) The program storage device of claim 16 wherein said determining 
comprises selecting a dispatch table from asaid plurality of dispatch tables in response to said receiving, 
said plurality of dispatch tables stored in a memory. 

(Claim 19). (Currently Amended) A program storage device readable by a machine, embodying a 
program of instructions executable by the machine to perform a method for executing an obfuscated 
application program, the method comprising: 

receiving an obfuscated application program, said obfuscated application program comprising at 
least one instruction opcode value encoded using one of a plurality of non-standard instruction set 
opcode value encoding schemes, 

wherein each of said non-standard instruction set opcode value encoding schemes include 
an entry corresponding to said at least one instruction opcode value^ 

each of said non-standard instruction opcode value encoding schemes is represented 
in a different dispatch table in a plurality of dispatch tables: 
each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction set ^aftd so that each of said non-standard instruction set 
opcode value encoding schemes uses a different opcode value encoding for said 
entry; 
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determining an instruction set opcode value encoding scheme associated with said obfuscated 
application program; 

rewriting said application program using a standard opcode value encoding scheme if said received 
application program is not encoded using said standard opcode value encoding scheme; and 
executing said application program using a dispatch table associated with said standard opcode 
value encoding scheme. 



(Claim 20). (Currently Amended) A program storage device readable by a machine, embodying a 
program of instructions executable by the machine to perform a method for application program 
obfuscation, the method comprising: 

reading an application program comprising code; 

transforming said application program code into transformed application program code that uses 
one of a plurality of opcode value encoding schemes of a dispatch table associated with said 
application program, 

wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to at least one instruction opcode value^ 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables; 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set; and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
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in said same instruction sek -aftd so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; and 
sending said transformed application program code. 



(Claim 31). (Currently Amended) An apparatus for executing an obfuscated application program, the 
apparatus comprising: 
a processor; and 

a memory, coupled to said processor, having stored therein computer readable instructions wherein 
executing said computer readable instructions on said processor provides: 

means for receiving an obfuscated application program, said obfuscated application program 
comprising at least one instruction opcode value encoded using one of a plurality of 
instruction set opcode value encoding schemes, 

wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to said at least one instruction opcode value A 

each of said instruction opcode value encoding schemes is represented in a 

different dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 

implementation methods in a same instruction set; and 

each of said instruction opcode value encoding schemes creates a different 

one-to-one mapping between a set of numbers and said instruction 

implementation methods in said same instruction setf -an4 so that each of said 
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instruction set opcode value encoding schemes uses a different opcode value 

encoding for said entry; 
means for determining a dispatch table associated with said application program, said 
dispatch table corresponding to said one of a plurality of instruction set opcode value 
encoding schemes; and 

means for executing said application program using said associated dispatch table. 



(Claim 33). (Currently Amended) The apparatus of claim 31 wherein said means for determining 
comprises means for selecting a dispatch table from a said plurality of dispatch tables in response to said 
receiving, said plurality of dispatch tables stored in a memory. 

(Claim 34). (Currently Amended) An apparatus for executing an obfuscated application program, the 
apparatus comprising: 
a processor; and 

a memory, coupled to said processor, having stored therein computer readable instructions wherein 
executing said computer readable instructions on said processor provides: 

means for receiving an obfuscated application program, said obfuscated application program 
comprising at least one instruction opcode value encoded using one of a plurality of non- 
standard instruction set opcode value encoding schemes, 

wherein each of said non-standard instruction set opcode value encoding schemes 
include an entry corresponding to said at least one instruction opcode value, 



Application/Control Number: 10/672,700 Page 11 

Art Unit: 2135 

each of said non-standard instruction opcode value encoding schemes is 
represented in a different dispatch table in a plurality of dispatch tables: 
each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 
each of said instruction opcode value encoding schemes creates a different 
one-to-one mapping between a set of numbers and said instruction 
implementation methods in said same instruction set^ -af>4 so that each of said 
non-standard instruction set opcode value encoding schemes uses a different 
opcode value encoding for said entry; 

means for determining an instruction set opcode value encoding scheme associated with said 

obfuscated application program; 

means for rewriting said application program using a standard opcode value encoding 
scheme if said received application program is not encoded using said standard opcode 
value encoding scheme; and 

means for executing said application program using a dispatch table associated with said 
standard opcode value encoding scheme. 



(Claim 35). (Currently Amended) An apparatus for application program obfuscation, the apparatus 
comprising: 

a processor; and 

a memory, coupled to said processor, having stored therein computer readable instructions wherein 
executing said computer readable instructions on said processor provides: 
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means for reading an application program comprising code; 

means for transforming said application program code into transformed application program 
code that uses one of a plurality of opcode value encoding schemes of a dispatch table 
associated with said application program, 

wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to at least one instruction opcode value^ 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction set ^-and so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; and 
means for sending said transformed application program code. 



(Claim 46). (Currently Amended) An apparatus for executing an obfuscated application program, the 

apparatus comprising a user device configured to: 

receive an obfuscated application program, said obfuscated application program comprising at least 
one instruction opcode value encoded using one of a plurality of instruction set opcode value 
encoding schemes, 
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wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to said at least one instruction opcode value A 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction sek -aftd so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; 
determine a dispatch table associated with said application program, said dispatch table 
corresponding to said one of a plurality of instruction set opcode value encoding schemes; and 
execute said application program using said associated dispatch table. 



(Claim 49). (Currently Amended) An apparatus for executing an obfuscated application program, the 
apparatus comprising a user device configured to: 

receive an obfuscated application program, said obfuscated application program comprising at least 
one instruction opcode value encoded using one of a plurality of non-standard instruction set 
opcode value encoding schemes, 

wherein each of said non-standard instruction set opcode value encoding schemes include 
an entry corresponding to said at least one instruction opcode value^ 
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each of said non-standard instruction opcode value encoding schemes is represented 
in a different dispatch table in a plurality of dispatch tables: 
each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction set ^-aftd so that each of said non-standard instruction set 
opcode value encoding schemes uses a different opcode value encoding for said 
entry; 

determine an instruction set opcode value encoding scheme associated with said obfuscated 
application program; 

rewrite said application program using a standard opcode value encoding scheme if said received 
application program is not encoded using said standard opcode value encoding scheme; and 
execute said application program using a dispatch table associated with said standard opcode value 
encoding scheme. 

(Claim 50). (Currently Amended) An apparatus for application program obfuscation, the apparatus 
comprising an application program provider configured to: 
read an application program comprising code; 

transform said application program code into transformed application program code that uses one of 
a plurality of opcode value encoding schemes of a dispatch table associated with said application 
program, 
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wherein each of said instruction set opcode value encoding schemes includes an entry 
corresponding to at least one instruction opcode value^ 

each of said instruction opcode value encoding schemes is represented in a different 

dispatch table in a plurality of dispatch tables: 

each dispatch table in said plurality of dispatch tables permutes instruction 
implementation methods in a same instruction set: and 

each of said instruction opcode value encoding schemes creates a different one-to- 
one mapping between a set of numbers and said instruction implementation methods 
in said same instruction sek -aftd so that each of said instruction set opcode value 
encoding schemes uses a different opcode value encoding for said entry; and 
send said transformed application program code. 



Reason for Allowance 

5. The following is the Examiner's statement of reasons for allowance: Applicant's 
arguments submitted on 25 February 2008 were considered persuasive - the prior art does 
not teach the limitations which have been amended onto independent claims. The closest 
prior art fails to disclose the features of in an obfuscated application program comprising at 
least one instruction opcode value encoded using one of a plurality of instruction set opcode 
value encoding schemes, wherein each of said instruction set opcode value encoding 
schemes includes an entry corresponding to said at least one instruction opcode value, each 
of said instruction opcode value encoding schemes is represented in a different dispatch 
table in a plurality of dispatch tables; each dispatch table in said plurality of dispatch tables 
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permutes instruction implementation methods in a same instruction set; and each of said 
instruction opcode value encoding schemes creates a different one-to-one mapping between 
a set of numbers and said instruction implementation methods in said same instruction set; 
so that each of said instruction set opcode value encoding schemes uses a different opcode 
value encoding for said entry in combination with the other limitations recited in independent 
claims 1,4-5, 16, 19-20, 31, 34-35, 46, 49-50 



Allowable Subject Matter 

6. Claims 1 -7, 1 6-22, 31 -37 and 46-52 are allowed. 

Contact Information 

Any inquiry concerning this communication or earlier communications from the examiner should be 
directed to April Y. Shan whose telephone number is (571) 270-1014. The examiner can normally be 
reached on Monday - Friday, 8:00 a.m. - 5:00 p.m., EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Kim Y. 
Vu can be reached on (571 ) 272-3859. The fax phone number for the organization where this application 
or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent Application 
Information Retrieval (PAIR) system. Status information for published applications may be obtained from 
either Private PAIR or Public PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) 
at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative 
or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272- 
1000. 

/April Y Shan/ 
Examiner, Art Unit 2135 
/KIMYEN VU/ 

Supervisory Patent Examiner, Art Unit 2135 



